Vendor backend and frontend into the monorepo

The submodule collapse was only half applied: .gitmodules was deleted but
backend/ and frontend/ were still recorded as gitlinks, so none of their
files were tracked. Replace the gitlinks with the real trees.

Also untrack .env (it carried placeholder secrets) in favour of a tracked
.env.example, drop the committed __pycache__, and narrow the blanket *.png
ignore that would have swallowed design assets.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.env.example

@@ -0,0 +1,43 @@
+# Template for the app stack's .env. The workspace root's scripts/setup.sh copies
+# this file to .env on first run and then keeps the shared keys in sync with the
+# root .env. Secrets stay as `changethis` here and are generated locally.
+
+# Domain Traefik routes on and acquires TLS certificates for.
+DOMAIN=localhost
+
+# Used by the backend to build links in outgoing emails.
+FRONTEND_HOST=http://localhost:5173
+
+# local, staging, production
+ENVIRONMENT=local
+
+PROJECT_NAME="Fluksio"
+STACK_NAME=fluksio-app
+
+# Backend
+BACKEND_CORS_ORIGINS="http://localhost,http://localhost:5173,http://app.localhost,https://localhost,https://localhost:5173"
+SECRET_KEY=changethis
+FIRST_SUPERUSER=admin@fluksio.com
+FIRST_SUPERUSER_PASSWORD=changethis
+
+# Emails
+SMTP_HOST=
+SMTP_USER=
+SMTP_PASSWORD=
+EMAILS_FROM_EMAIL=noreply@fluksio.com
+SMTP_TLS=True
+SMTP_SSL=False
+SMTP_PORT=587
+
+# Postgres
+POSTGRES_SERVER=localhost
+POSTGRES_PORT=5432
+POSTGRES_DB=app
+POSTGRES_USER=postgres
+POSTGRES_PASSWORD=changethis
+
+SENTRY_DSN=
+
+# Docker registry images
+DOCKER_IMAGE_BACKEND=fluksio-backend
+DOCKER_IMAGE_FRONTEND=fluksio-frontend